Last updated 22 October 2026, 9:26 pm AEDT, from the latest Cloudways status. This is a service notice, not a marketing article. We will update it when Cloudways marks the incident resolved.
On 21 October 2026 the PHP Group disclosed critical remote code execution vulnerabilities in PHP, reported as CVE-2026-109618 and CVE-2026-109619 and widely referred to as PHP2Shell. PHP powers a large share of the web, including WordPress, so hosting providers everywhere are applying emergency patches. Our hosting provider, Cloudways, is one of them.
In short: this is an industry-wide PHP issue, not a problem specific to imexpert.au. Cloudways put interim protections in place on 21 October and has since completed the rollout of the official patches to all active servers. The incident stays open while Cloudways monitors for any further issues. You may have noticed a small status notice at the top of our site while this ran; it reads the Cloudways status feed directly and clears itself once the incident is resolved.
What Cloudways has done so far
The timeline below is taken from the Cloudways incident page, with times converted from UTC to Sydney time (AEDT).
- Wed 21 Oct, 8:16 pm: Incident opened as Identified. Cloudways began applying interim mitigations to PHP environments ahead of the official patches, warning that these could cause a short service disruption. Deprecated PHP versions are being covered through its extended long-term support partners.
- Thu 22 Oct, 3:43 am: Cloudways confirmed the PHP Group disclosure, noted that all customers had been notified on the morning of 21 October, and said further interim configuration-level mitigations recommended by the PHP Group were being applied while the patch rollout was prepared.
- Thu 22 Oct, 9:19 am: Interim mitigations deployed across the whole fleet. The phased rollout of official security patches began, covering PHP 5.6, 7.4, 8.0, 8.1, 8.2, 8.3 and 8.4. Cloudways stated this does not affect the availability of customer websites.
- Thu 22 Oct, 12:02 pm: Status moved to Monitoring. Patches applied to all applications on Cloudways Autonomous. Rollout to Cloudways Flexible continuing.
- Thu 22 Oct, 3:07 pm: Flexible rollout in progress and on schedule. Cloudways said no action is needed from customers and that interim protections stay in place on every site until deployment is complete.
- Thu 22 Oct, 9:20 pm: Cloudways reported the PHP security patch rollout complete, with all active servers successfully updated. Its support team is contacting a small number of customers whose environments need extra help.
- Thu 22 Oct, 9:22 pm: Status remains Monitoring while Cloudways watches for any further issues.
Separately, the Cloudways website and affiliate portal were offline for part of Thursday morning, AEDT, while Cloudways patched its own platform. That maintenance is complete and was reported as separate from customer websites.
What this means for imexpert.au
imexpert.au is hosted on Cloudways and was covered by the same rollout. If you ever hit a brief interruption on our site, waiting a minute and reloading is all that is needed, and you can always reach us through the contact page.
What this means if we host your website
If your website is hosted on Cloudways through us, the same interim protections and the same patch rollout apply to it. You do not need to do anything. We are watching the Cloudways status page and will confirm once the incident is closed.
If your site is hosted elsewhere, your host should have published its own notice. If you have not seen one, ask them directly whether the PHP2Shell patches have been applied to your server.
What every website owner should check this week
- Confirm your host has patched. A status page update or an email from your host is what you are looking for. Silence is not confirmation.
- Know your PHP version. If your site still runs PHP 7.4 or older, this is the moment to plan an upgrade. Patches for end-of-life versions depend on paid extended support arrangements and will not keep arriving indefinitely.
- Keep WordPress, themes and plugins current. The PHP patch closes this hole, but outdated plugins remain the most common way a site is compromised.
- Check your backups actually restore. A backup you have never tested is a hope, not a plan.
- Watch for anything unusual. New admin users, unexpected files, redirects or spam pages appearing in search results all warrant a closer look.
Sources and live status
Live updates from our host are on the Cloudways status page. The vulnerability identifiers above come from public reporting on the disclosure and are not named on the Cloudways page. If you have questions about your own site, contact us and we will help you check.